[PATCH net v4 3/3] net: dsa: mxl862xx: do not leak firmware result values at ALLOC call sites
flat view
From: <hidden>
Date: 2026-10-31 08:18:28
Subsystem:
maxlinear mxl862xx switch driver, networking drivers, networking [dsa], the rest · Maintainers:
Daniel Golle, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Andrew Lunn, Vladimir Oltean, Linus Torvalds
From: Zhang Hewei <redacted>
MXL862XX_API_READ() returns the firmware result value (>= 0) on
success. The ALLOC-style call sites (QOS_METERALLOC,
EXTENDEDVLAN_ALLOC, VLANFILTER_ALLOC) test the result with
"if (ret) return ret;", so a non-zero firmware status is returned to
callers that only check ret < 0 and can end up stored as a block or
filter id.
Split transport status from the payload at the three ALLOC call
sites: forward negative errnos, turn a non-zero firmware status into
-EIO, and continue on the ret == 0 path where the payload id is read
from the command structure.
Fixes: 340bdf984613c4a9 ("net: dsa: mxl862xx: implement bridge offloading")
Reported-by: netdev-bot+sashiko@kernel.org
Signed-off-by: Zhang Hewei <redacted>
---
drivers/net/dsa/mxl862xx/mxl862xx.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index fe4db9b7f..c599b1c1e 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c@@ -352,8 +352,10 @@ static int mxl862xx_setup_drop_meter(struct dsa_switch *ds) /* meter_id=0 means auto-alloc */ ret = MXL862XX_API_READ(priv, MXL862XX_QOS_METERALLOC, meter); - if (ret) + if (ret < 0) return ret; + if (ret > 0) /* firmware reported a non-zero result code */ + return -EIO; meter.enable = true; meter.cbs = cpu_to_le32(64);
@@ -532,8 +534,10 @@ static int mxl862xx_evlan_block_alloc(struct mxl862xx_priv *priv, param.number_of_entries = cpu_to_le16(blk->block_size); ret = MXL862XX_API_READ(priv, MXL862XX_EXTENDEDVLAN_ALLOC, param); - if (ret) + if (ret < 0) return ret; + if (ret > 0) /* firmware reported a non-zero result code */ + return -EIO; blk->block_id = le16_to_cpu(param.extended_vlan_block_id); blk->allocated = true;
@@ -552,8 +556,10 @@ static int mxl862xx_vf_block_alloc(struct mxl862xx_priv *priv, param.discard_unmatched_tagged = 1; ret = MXL862XX_API_READ(priv, MXL862XX_VLANFILTER_ALLOC, param); - if (ret) + if (ret < 0) return ret; + if (ret > 0) /* firmware reported a non-zero result code */ + return -EIO; *block_id = le16_to_cpu(param.vlan_filter_block_id); return 0;
--
2.39.5 (Apple Git-154)